Add an in-memory superusermanager, which stores the current list of superusers in a process-shared Value. We do this because in the ER, when we add a new superuser, we need to ensure that ALL workers have their lists updated (otherwise we get the behavior that some workers validate the new permission and others do not).

endpoints/api/suconfig.py

@@ -7,7 +7,7 @@ from endpoints.api import (ApiResource, nickname, resource, internal_only, show_
                            require_fresh_login, request, validate_json_request, verify_not_prod)
 
 from endpoints.common import common_login
-from app import app, CONFIG_PROVIDER
+from app import app, CONFIG_PROVIDER, superusers
 from data import model
 from auth.permissions import SuperUserPermission
 from auth.auth_context import get_authenticated_user
@@ -49,7 +49,7 @@ class SuperUserRegistryStatus(ApiResource):
       'file_exists': file_exists,
       'is_testing': app.config['TESTING'],
       'valid_db': database_is_valid(),
-      'ready': not app.config['TESTING'] and file_exists and bool(app.config['SUPER_USERS'])
+      'ready': not app.config['TESTING'] and file_exists and superusers.has_superusers()
     }
 
 
@@ -215,7 +215,7 @@ class SuperUserCreateInitialSuperUser(ApiResource):
       CONFIG_PROVIDER.save_yaml(config_object)
 
       # Update the in-memory config for the new superuser.
-      app.config['SUPER_USERS'] = [username]
+      superusers.register_superuser(username)
 
       # Conduct login with that user.
       common_login(superuser)